Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 16:17
Behavioral task
behavioral1
Sample
3d5055dcac7d5b42a4916ddd4b15af04.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3d5055dcac7d5b42a4916ddd4b15af04.exe
Resource
win10v2004-20231215-en
General
-
Target
3d5055dcac7d5b42a4916ddd4b15af04.exe
-
Size
947KB
-
MD5
3d5055dcac7d5b42a4916ddd4b15af04
-
SHA1
ef8dbee22d48618b9f968dd9d29baec005270545
-
SHA256
c5b6e6871deedce923b4687e2f9b503445a8fd4d6d7bf1d313725c27a7ab2c93
-
SHA512
e27646698ca8d7b71c875cd33abf7650ef501190e6d39fad6fa31faabb4b83ec7216cb4889c5b55ceda64bb0ef2d2b8092d4559d1e521a26c2991e680e1d4475
-
SSDEEP
24576:J0u9wol3NKrW8z5n5K6rUDSPVAPgyhKT0LE8XREpxT2puPHyIO:n9wwdK/zN5wO2eTQ9REpw6c
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4284 3d5055dcac7d5b42a4916ddd4b15af04.exe -
Executes dropped EXE 1 IoCs
pid Process 4284 3d5055dcac7d5b42a4916ddd4b15af04.exe -
resource yara_rule behavioral2/memory/2624-0-0x0000000000400000-0x00000000005DC000-memory.dmp upx behavioral2/files/0x000a000000022ffd-12.dat upx behavioral2/memory/4284-14-0x0000000000400000-0x00000000005DC000-memory.dmp upx -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4224 schtasks.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2624 3d5055dcac7d5b42a4916ddd4b15af04.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2624 3d5055dcac7d5b42a4916ddd4b15af04.exe 4284 3d5055dcac7d5b42a4916ddd4b15af04.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2624 wrote to memory of 4284 2624 3d5055dcac7d5b42a4916ddd4b15af04.exe 93 PID 2624 wrote to memory of 4284 2624 3d5055dcac7d5b42a4916ddd4b15af04.exe 93 PID 2624 wrote to memory of 4284 2624 3d5055dcac7d5b42a4916ddd4b15af04.exe 93 PID 4284 wrote to memory of 4224 4284 3d5055dcac7d5b42a4916ddd4b15af04.exe 94 PID 4284 wrote to memory of 4224 4284 3d5055dcac7d5b42a4916ddd4b15af04.exe 94 PID 4284 wrote to memory of 4224 4284 3d5055dcac7d5b42a4916ddd4b15af04.exe 94 PID 4284 wrote to memory of 3960 4284 3d5055dcac7d5b42a4916ddd4b15af04.exe 97 PID 4284 wrote to memory of 3960 4284 3d5055dcac7d5b42a4916ddd4b15af04.exe 97 PID 4284 wrote to memory of 3960 4284 3d5055dcac7d5b42a4916ddd4b15af04.exe 97 PID 3960 wrote to memory of 1328 3960 cmd.exe 99 PID 3960 wrote to memory of 1328 3960 cmd.exe 99 PID 3960 wrote to memory of 1328 3960 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d5055dcac7d5b42a4916ddd4b15af04.exe"C:\Users\Admin\AppData\Local\Temp\3d5055dcac7d5b42a4916ddd4b15af04.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\3d5055dcac7d5b42a4916ddd4b15af04.exeC:\Users\Admin\AppData\Local\Temp\3d5055dcac7d5b42a4916ddd4b15af04.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\3d5055dcac7d5b42a4916ddd4b15af04.exe" /TN aMYATtOZda0c /F3⤵
- Creates scheduled task(s)
PID:4224
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN aMYATtOZda0c > C:\Users\Admin\AppData\Local\Temp\geBGs.xml3⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN aMYATtOZda0c4⤵PID:1328
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
947KB
MD52020873546339d36b2065dc61f0c3f6e
SHA12fa99a8e4f3be12bcad9f95c4d98aaf872565f00
SHA2567c2d84f3322a048f974fd963aa64fa0484fd052a9ace9a10d10cc3e60b56cb56
SHA512e0f92a58b2225a1c465fa74101af3e826052f79c7982510b6029add22be2a405bf35c8d1571a36865c9a4f045cc7594c9abe6cef1f00127e1aaf266546b88b28
-
Filesize
1KB
MD5ae5b945606ed29ab4515f88b8e32fd05
SHA1cb0d9e813f23c08cbbae91f96724a2d830113fe1
SHA25698b34b56ab9159508afb2b9207c305c917cf5dd7b00d743e5b8020fe1b67e4ef
SHA512691fd1a4a67d7435145bb1b62921c9fb0e35a1231cf15b49a490470a4100293742c02e93607df02c0bbf6983f7dee9c33109ea1f5652d4882059d42b4c2f7434